Where a regional bank's technology risk actually sits

I have taken a regional bank off its own mainframe and onto a core system shared with eight other banks, and I know which parts of that decision are technical and which are not. The technical work is data conversion, reconciliation and rehearsal: we ran five full rehearsals and, from the fourth, reconciled every account to the yen rather than sampling. The harder work is deciding which products and processes to give up, explaining the change to 1.6 million customers and agreeing go-live criteria with the board before any date is announced. A member of a shared system also has to influence a common release calendar and a common change budget through a committee of peers. I represent Shiomine on the Kaname resilience committee, where I argue for joint failure exercises and against changes that add risk for every member in order to suit one.

Many Japanese regional banks still run, or have only recently left, mainframe applications written in COBOL and assembler during the 1980s and 1990s. The engineers who wrote them are retiring, and at least one major domestic manufacturer has announced that it will stop making mainframes later this decade. I treat this as a problem of undocumented business rules rather than of programming languages. At Shiomine we kept eleven re-employed engineers on their final pay to explain the system, paired each with two younger colleagues and built a library of 2,140 rules that the owning business divisions now sign. I can help a board judge how far its institution depends on a handful of individuals, how to test that dependence and what it costs to reduce it before a migration rather than in the middle of one.

The Financial Services Agency does not forbid banks to use public cloud. It expects a bank to remain responsible for what it outsources: to understand the provider's controls, keep the access it needs for audit and inspection, know where its data is held, plan for the provider's failure and be able to leave. I treat those expectations as engineering requirements. Our analytics platform moved to public cloud in October 2025 only after a team rebuilt its critical reports in our own data centre from routine exports, inside the 72 hours we had promised the board. Our core ledger remains in the Kaname data centres, and I do not expect it to move to public cloud while the combined concentration of a shared core on a single provider cannot be rehearsed. I explain these choices to our supervisor in the same terms I use with our directors.

I measure cyber resilience by how long it actually takes to restore critical services from clean backups, tested in isolation and without warning, rather than by the objectives written into a continuity plan. Our 2023 test took 61 hours against a stated twelve. After we separated backups from the production administrative domain and cut privileged accounts from 388 to 74, the 2025 test took 9 hours 40 minutes. I also insist that the business agrees the order of restoration in advance; for us, corporate salary payments due on the 25th come before internet banking log-in. Since a direct-mail contractor's ransomware incident exposed about 8,300 of our customers' names and addresses in 2024, our exercises include the 41 contractors that hold customer data. Our board takes part in a tabletop exercise each year, and we join the industry-wide exercises the FSA organises.

Japan's move away from cash has been led by card and code-payment services that operate across the country, not by banks' own apps. I think a regional bank's role is to be the trusted account behind those services and the settlement bank for local merchants, rather than to run a competing wallet with a fraction of their users. That view comes from running card authorisation and merchant acquiring at Seiran Card Services, and from closing Shiomine's own app in 2026. The technology work is less visible than an app: strong verification when customers link their accounts to outside payment services, a weakness criminals exploited at several Japanese banks in 2020; dependable settlement into merchants' accounts; and fraud monitoring that follows a customer across channels. I can help a board decide which payment services it must own and which it should simply connect to well.